CVE-2026-128074

Nuxt strips trailing slashes from the request path with a regular expression whose cost grows quadratically with the length of a run of consecutive slashes. A single unauthenticated request with a long run of slashes can occupy the server's event loop for a noticeable time, delaying every other request handled by the same process.

When a page is rendered with payload extraction (any route covered by an isr, swr or cache route rule), Nuxt builds the _payload.json URL from the raw request path. A path such as /blog/a followed by 16,000 slashes and x, which fits within Node's default header size limit, takes roughly 0.1 to 0.4 seconds of synchronous CPU time per request, depending on hardware. Concurrent requests to the same process wait for it to finish, so a modest request rate can keep a process saturated.

An app is affected if it uses Nuxt 4.6.0 or later with server-side rendering and has a route rule like: